I wanted to create a zone named "bad" with a target=reject and source= which will basically reject all traffic from that subnet. In the zone.

Now, if I want to allow traffic to SSH from that subnet, how can I do that?

I tried adding service SSH to "bad" zone but no luck, then I tried to add a rich rule no luck...

I tried to do what a firewall would normally do, which is denying all request that didn't match any rule...


  • First of all, I think you meant the network with the following CIDR notation Show more details please. We need something like firewall-cmd --zone=$(firewall-cmd --get-default-zone) --list-services . What does this return? Subsequently, you could add the ssh service using firewall-cmd --zone=$(firewall-cmd --get-default-zone) --add-service=ssh. Without more details, it's hard to troubleshoot the problem – Valentin Bajrami Sep 1 '16 at 20:44
  • CentOS 6 or 7? It makes a difference, at least for stock CentOS, because of the move from iptables to firewalld (at least, I think that's what it's called; I cordially dislike systemd, so have steered clear of C7 so far). – MadHatter Sep 2 '16 at 7:33

Would something like this work? I'm frankly not sure if this covers your situation or not. It seems like it would but I've not tested it. This would be if you wanted to, say, allow incoming ssh connections from

INPUT -p tcp -s --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Source: https://www.digitalocean.com/community/tutorials/iptables-essentials-common-firewall-rules-and-commands

| improve this answer | |

firewall-cmd --permanent --new-zone=bad

firewall-cmd --zone=bad --add-rich-rule 'rule family=ipv4 service name=ssh source address= accept' --permanent

firewall-cmd --set-default=bad --permanent

firewall-cmd --reload

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.